@211la/search-client (>=0.1.0, <=0.5.0), @2bad/bitrix (>=2.0.0, <=2.3.0) +15 more potentially affected by CVE-2022-24999 via qs (6.8.0)

qs NPM version 6.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on qs and may be impacted: - @211la/search-client =0.1.0, =2.0.0, =0.0.0-GO-1036-new-endpoint-to-download-bulk-details.3, =9.1.23-alpha2.60, =0.6.4, =2.1.1, =0.1.0, =3.4.5, =1.0.0, =0.1....

@1doc3/hermes-chat (>=0.0.0, <=0.4.74), @1doc3/synapse-wizard (>=0.0.0, <=0.5.119) +624 more potentially affected by unknown CVE via sweetalert2 (>=8.19.1, <=11.22.3)

sweetalert2 NPM version =8.19.1, =0.0.0, =0.0.0, =0.1.0, =2.31.0, =0.0.1-beta.1, =0.1.1, =1.0.1, =1.0.0, =1.0.0, =0.0.9, =0.0.1, =0.3.73, =0.3.198 and more Source cves: unknown CVE Source advisory: OSV:GHSA-8JH9-WQPF-Q52C...

100 Apps, Endless Security Checks

On average, organizations report using 102 business-critical SaaS applications, enabling operations of most departments across an organization, such as IT and Security, Sales, Marketing, R&D, Product Management, HR, Legal, Finance, and Enablement. An attack can come from any app, no matter how...

@abstraktor/actordemo (>=0.0.0-ad-beta.1, <=0.0.0-ad-beta.2), @abstraktor/actorjs (>=0.0.0-aj-alpha.9, <=0.0.0-aj-beta.6) +175 more potentially affected by CVE-2022-24066 +1 more via simple-git (>=3.0.3, <=3.14.1)

simple-git NPM version =3.0.3, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =1.4.0, =5.15.0, =10.0.0-version-usage.0, =1.0.1, =2.0.0, =1.1.0, =1.1.0, =0.0.0-semantic-release, =1.1.12, =0.0.1, =0.0.63 - @custis/file-adapter-front 1.1.1 and more Source cves: CVE-2022-24066, CVE-2022-25912 Source advisory:...

Researchers Uncover PyPI Package Hiding Malicious Code Behind Image File

A malicious package discovered on the Python Package Index PyPI has been found employing a steganographic trick to conceal malicious code within image files. The package in question, named "apicolor," was uploaded to the Python third-party repository on October 31, 2022, and described as a "Core...

OnePlanet Announces Support for Polygon-based Launchpad Services

By Deeba Ahmed This connectivity between the NFT launchpad and the Polygon ecosystem will allow the minting of new collections on the Polygon network. This is a post from HackRead.com Read the original post: OnePlanet Announces Support for Polygon-based Launchpad Services...

@apexdevtools/apex-ls (>=3.1.0, <=3.2.0), @appium/fake-driver (>=3.2.3, <=3.2.4) +47 more potentially affected by CVE-2022-39353 via @xmldom/xmldom (>=0.7.0, <=0.7.6)

@xmldom/xmldom NPM version =0.7.0, =3.1.0, =3.2.3, =1.0.0-beta1, =15.1.0, =15.1.0, =15.1.0, =15.1.0, =0.1.0-beta.57, =0.1.5-beta.1, =1.0.0, =1.0.0, =1.0.0, =1.0.11 and more Source cves: CVE-2022-39353 Source advisory: OSV:GHSA-CRH6-FP67-6883...

Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity

Microsoft has discovered recent activity indicating that the Raspberry Robin worm is part of a complex and interconnected malware ecosystem, with links to other malware families and alternate infection methods beyond its original USB drive spread. These infections lead to follow-on...

Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity

Microsoft has discovered recent activity indicating that the Raspberry Robin worm is part of a complex and interconnected malware ecosystem, with links to other malware families and alternate infection methods beyond its original USB drive spread. These infections lead to follow-on...

How to Use Passkeys in Google Chrome and Android

Google wants to make your digital life—in its ecosystem, anyway—passwordless and more secure...

Spring at JavaOne 2022

Hi, Spring fans! Its Sunday the 16th of October as I write this and Im winging my way to sunny Las Vegas, Nevada, where Ill be attending and presenting at the first JavaOne show in years! It didnt exist as the JavaOne we know and love for years, even before the pandemic interrupted life as we kno...

Learn more about Spring Framework 6 and Spring Boot 3 in these two great talks from Devoxx 2022

Hi, Spring fans! I was just at Devoxx in Belgium, where hundreds of experts from across the Java ecosystem converged for the first time since 2019 to deliver their biggest and best. I could do a proper trip report, but I really just came here to point you to two talks from two of my amazing...

Microsoft named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Information and Event Management

Security operations teams are overwhelmed trying to protect their organizations against an onslaught of cyberattacks, including a 92 percent rise in ransomware attacks.1 Too often, existing security tools are siloed or not designed to meet the needs of today’s hybrid cloud environment. The result...

Microsoft named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Information and Event Management

Security operations teams are overwhelmed trying to protect their organizations against an onslaught of cyberattacks, including a 92 percent rise in ransomware attacks.1 Too often, existing security tools are siloed or not designed to meet the needs of today’s hybrid cloud environment. The result...

czkawka_gui_orbtk (>=1.0.1, <=1.5.1), orbtk-simple-modal (0.1.0) +1 more potentially affected by unknown CVE via orbtk (>=0.1.9, <=0.3.1-alpha3)

orbtk CARGO version =0.1.9, =1.0.1, =0.1.0, =0.1.10 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0060...

addr2line (0.7.0), aether (>=0.0.1, <=0.0.3) +357 more potentially affected by unknown CVE via parity-wasm (>=0.17.0, <=0.45.0)

parity-wasm CARGO version =0.17.0, =0.0.1, =0.1.0, =0.26.1, =0.3.10, =0.0.1, =0.0.0, =0.0.1, =0.1.0, =0.4.1, =0.1.0, =0.2.0, =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0061...

New Malware Families Found Targeting VMware ESXi Hypervisors

Threat actors have been found deploying never-before-seen post-compromise implants in VMware's virtualization software to seize control of infected systems and evade detection. Google's Mandiant threat intelligence division referred to it as a "novel malware ecosystem" that impacts VMware ESXi,...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.0), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=5.7.6) +65 more potentially affected by CVE-2022-22984 +1 more via snyk-python-plugin (>=1.0.0, <=1.24.0)

snyk-python-plugin NPM version =1.0.0, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =3.2.4, =0.0.2, =0.0.11, =1.0.1 and more Source cves: CVE-2022-22984, CVE-2022-40764 Source advisory: SNYK:JS-SNYKPYTHONPLUGIN-3039677...

Experts Uncover 85 Apps with 13 Million Downloads Involved in Ad Fraud Scheme

As many as 75 apps on Google Play and 10 on Apple App Store have been discovered engaging in ad fraud as part of an ongoing campaign that commenced in 2019. The latest iteration, dubbed Scylla by Online fraud-prevention firm HUMAN Security, follows similar attack waves in August 2019 and late 202...

MetaMask: Possible to spoof Origin in "Connected Sites"

A vulnerability was discovered in MetaMask that allowed for the spoofing of the origin domain name in the "Connected Sites" list. This was caused by a CSS style sheet that set the direction to "right-to-left", which resulted in the order of characters in the domain name being messed up and...